What’s Vulnerable › Vulnerabilities

CVE-2017-0260

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 19.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-06-15 · updated 2026-06-17

Description

A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, and CVE-2017-8506.

Affected products

• Microsoft Office: 2013-sp1, 2016
• Microsoft Windows 7: all versions
• Microsoft Windows Server 2008: r2-sp1
• Microsoft Office: Microsoft Office 2013 Service Pack 1 Click-to-Run (C2R), Microsoft Office 2016 Click-to-Run (C2R), Windows 7, Windows Server 2008 and Windows Server 2008 R2.

References

• http://www.securityfocus.com/bid/98810
• http://www.securitytracker.com/id/1038668
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0260
• http://www.securityfocus.com/bid/98810
• http://www.securitytracker.com/id/1038668
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0260

Get alerted when CVE-2017-0260 or the next vulnerability affects your stack